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The Director ot Central Intelligence 

Washington, D C 20505 

Resource Management Staff DCI/RM 80-2412 

9 April 1980 



MEMORANDUM FOR: Director of Central Intelligence 


STATINTL FROM: 



Director, Information Resources Office 


SUBJECT: 


Project SAFE 


REFERENCES: 


STATINTL 


A. Memo from D/IRO to DCI dtd 26 Mar 80, 
same subject (Tab A) 

B. Memo from D/ODP to DCI dtd 26 Mar 80 

Subject: Concerns Regarding SAFE (Tab B) 

C. Your memo of 21 March, Subject: Concerns 
Regarding 

D. Memo from Chairman, STAP 

to DCI dtd 18 Mar 1980, Subject: Questions 
Regarding SAFE 


1. Supplementing my memo to you, referenced above, I have 
again conferred with the Director, CSPO, and he has furni shed me 
with copies of Change Order No. 20 which was executed 27 March 
1980. This change order appears to me to adequately provide for 
the satisfaction of the requirement for the interconnection of the 
CIA and DIA SAFE systems for IOC. 

2. I have also had an opportunity to review the referenced 
memorandum to you from Bruce Johnson, D/ODP, and Clarus Rice, 
D/OCR, and I concur in the manner in which they respond to your 
concerns . 

3. As the project progresses, the IOC characteristics of the 
system are becoming defined with greater precision. Good manage- 
ment practice dictates that we proceed to IOC implementation 
without any substantial changes in the basic design concept. 
However, as pointed out in my previous memo to you on this 
subject, the design-to cost approach which was adopted has 
resulted in the necessity for deferring for later implementation 
some of the capabilities of the system embodied in the original 
design concept. I believe that the SAFE Project Office will soon 
be in a position to define fairly specifically which capabilities 
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will be deferred if current funding levels are adhered to. We are 
giving strong consideration to including this as an agenda item 
for our FY 82-86 Program Review. 


STATINTL 


Attachment : 
Tabs A & B 
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SUBJECT: Project SAFE 


Distribution: DCI/RM 80-2412 

Ori g - Adse (w/att) 

1 - DDC I (w/att) 

1 - DDA (w/att) 

1 - D/NFAC (w/att) 

1 - D/ODP (w/att) 

1 - D/CSPO (w/att) 

1 - C/OCR/SAS (w/att) 

1 - Executive Registry (w/att) 
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Washington. [)(] 2U50o 


Resource Management Staff 


I H C /MM 80 -2408 
26 March .1980 


MEMORANDUM FOR: 
VIA: 

FROM: 


SUBJECT: 
REFERENCE : 


1. I appreciate the opportunity to comment on the issues 
raised by the STAP Panel in connection with the SAFE Project. As 
background to our comments, I should point out that last year, 
after discussions between the D/DCI/RM, the DDCI, and DDA, it was 
determined that the focus of our interest in SAFE was to be "the 
areas of resource allocation and the relationship of SAFE to other 
programs on a Community -wide basis."* Although we have continued 
to review the development of Project SAFE, our primary attention 
has been in accorda nee . wi th the above quoted limitations. Conse- 
quently, we are not prepared to comment, except in general terms, 
on many of the concerns raised in the referenced STAP memorandum. 

2. Of the four principal concerns listed in your memo of 
March 21st, only one falls within the scope of IRO's responsi- 
bility as set forth in paragraph 1 above, namely: 

"What actions are underway to ensure that the Intelli- 
gence Community has access to CIA SAFE and that CIA SAFE 
has access to D I A SAFE as well as such systems as COINS 
and SOLIS?" 


Director of Central Intelligence 

Deputy to the DCI for Resource Management 

nrector, Resources Office 

Project SAFE 

A. Your memo of 21 March, Subject: Concern 
Regarding SAFE (Tab A) 

from STAP 

to DCI dtd 18 Mar 1980, Subject: Questions 
Regardi ng SAFE (Tab B) 


*Memo "from DDCI to D/DCI/RM dated 16 March 1979, Subject: Project 
SAFE 



/SgjproMetd Ff<?r e linos 

be addressed because: - 

0 At the DCI’s semiannual review in May 1979 , it was 
stated that a direct physical link between the DIA 
and CIA systems would be provided. 

0 Our review of the current version of the System 
Requirements Specifications indicates that such a 
communications connection between CIA and DIA SAFE 
systems is not included in the specifications. 

0 I have discussed this deficiency to the attention of 
the SAFE Project Manager and ho. states that such a 
requirement will be added by amendment; that, 
although this has not yet been accomplished, such an 
amendment will be prepared in the near future. 

4 . We believe that it is crucial to the ultimate development 
of the types of intercommunication which are set out in your 
subject memorandum that this requirement be now formalized, in the 
SAFE documentation since, if properly specified, it will provide 
the technical capability to enable: 

0 CIA analysts to access DIA files. 

0 CIA analysts to access other Community files 
through the DIA SAFE interface with the COINS 
network which is included in the current 
requirements documents. 

0 DIA analysts to access CIA SAFE files. 

.0 Analyst to analyst communications between DIA 
and CIA analysts . 

0 The capability to permit other Intelligence 

Community components to access CIA SAFE facilities 
by going through the DIA interfaces with the COINS 
or AUTODIN networks. 

5 . It should be noted that the provision of the physical 
links and the technical capabilities to accomplish the above 
listed functions will not, in and of i tsel f , resul t in the 
implementation of any of these functions. None of the SAFE 
documentation, either emanating from DIA or CIA, calls for these 
functions to-be provided. Indeed, the original CIA SAFE docu- 
mentation specifically provides that the CIA SAFE system will be a 
closed system accessible -only by CIA personnel. The position has 
been taken by some that CIA has no validated requirement for 
access to any non-CIA system, including DIA SAFE. The results of 
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the IHC -sponsored Analyst Support Study indicate that this is 
probably not the case. Nearly half of the CIA analysts 
interviewed said they regularly access outside data bases such as 
SOLIS, the COINS files, CIRC II, and the NPIC data system. 
Furthermore, analyst-to-analyst communication across agency lines 
was ranked the second most important source of information by CIA 
analysts and the most important source by DIA analysts. As 
automated systems develop and improve and analysts become 
increasingly confident in their use of and reliance upon direct 
access to automated systems, requirements for and the value of 
access to external systems should increase still further. 


6. The management of the Consolidated SAFE Project Office is 
working under a handicap in this area. There has been, to our 
knowledge, no extensive formal review or update of CIA's 
functional requirements on the user side since the decision was 
made to combine the two programs. Without any formal statement of 
requirements from the CIA analytical community (primarily NFAC) 
which the system is designed to support, it is difficult for those 
charged with designing and implementing the system to anticipate 
what those needs may be. Therefore, we suggest that either you or 
some other appropriate authority should give to the SAFE Project 
Office some appropriate guidance which addresses these areas of 
concern. 


7. We would call to your attention the fact that providing 
any' access to the CIA system from DIA and more especially from 
elements of the Intelligence Community outside of DIA raises 
serious security issues. The resolution of these issues will 
probably require action on your part to modify the present 

i nterpretati on of existing security policies, or in some cases 
amendments thereto. If you should decide that the combined SAFE 
systems should provide the types of intercommunication and outside 
access which are outlined in your areas of concern, then someone 
(possibly the Computer Security Subcommittee of the DCI Security 
Committee) should probably be tasked with the respons i bi 1 i ty of 
defining the security issues, suggesting possible solutions, and 
performing appropriate risk analyses so that they may be submitted 
to you for resolution. If this is undertaken, I RO should probably 
be involved in some way since decisions on these issues will * 
undoubtedly have major long-term effects on the feasibility of 
improving the interagency exchange of information and could also 
have a substantial impact on the resources which, will be needed to 
satisfy Community ADP requirements.. 

8. General comments on other concerns expressed by you based 
upon our limited perspective are: 


3 
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o We are informed that of OCR is coordinating 

the CIA user interface with the CSPO; that he is 
completely aware of the status of the project and 
consults regularly with the CSPO. 

o In the development of a project such as SAFE, it is 
extremely important that a well defined single point 
of contact between the users and developers be 
established and maintained. Otherwise, the system 
developers will be faced with conflicting statements 
of requ i rements . 

o If, in fact, the established lines of communications 
with the users are not adequate, perhaps the reason 
is attributable to a lack of an effective framework 
within NFAC to provide a continuing review of SAFE 
as it develops. If this is the case, we are not aware 
of it. 

o We see no evidence that "major portions of the 

proposed operational capabilities are unspecified." 

It is, however, probably true that NFAC should direct 
more attention to the general issue of what its 
requirements for open source material are and how 
these should be met, either through SAFE or other 
means. 

o The decision to place SAFE on a design-to-cost basis 
necessarily implied some scaling down of the original 
requirements for the initial version. In consonance 
with this, NFAC did review and set priorities on the 
original SAFE requirements. 

o It is our assessment that the CSPO is proceeding with 
development so that NFAC's highest priorities will be 
met first and the design will accommodate the later 
addition of those functions which now enjoy a lesser 
priority. 

o If some of the capabilities which this approach will 
require to be deferred are considered to be important 
enough to warrant it, NFAC should develop a justifi- 
cation for their inclusion in the initial version of 
SAFE and the issue should be addressed durinq proqram 
review. 


9. In. conclusion, I would take this opportunity to inform 
you of two initiatives we are taking in conjunction with the IHC 
which may have an impact on the future development of SAFE. 
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o The development of a user language for SAFE will 
result in a common user language for DIA & CIA. 

We are exploring the possibility that this could 
become the initial step for developing user language 
standards for use throughout the Community. This will 
require the cooperation of the SAFE Project Office 
if it is to succeed . 

o We expect the IHC to recommend the development 
of a distributed system of bi bl i ographic i nforma - 
tion storage and retrieval systems. If this is 
to be done, the facilities of both the DIA & CIA 
SAFE systems in this area will have to function 
as part of an overall Community system. If this 
is to be accomplished, the interconnection of 
the two systems could taken on added importance. 

NTL 
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ODP 0-369 
26 March 1980 


Director of Central Intelligence 

Deputy Director for Administration 
Director, National Foreign Assessment. Center 

Bruce T. Johnson 

Director of Data Processing, DDA 
Clarus W. Rice 

Director of Central Reference, NFAC 
SUBJECT: Concerns Regarding SAFE 

REFERENCE: Your memo dtd 21 March 1980, same subject 

(ExReg 80-754/1) 


MEMORANDUM FOR: 
VIA: 

FROM: 


BTATINTL 


3TATINTL 


I 

st|atintl 

t • 

i ; 

I 

i 

i 

i l 


1. This memorandum responds to your query of 21 March 
1980, transmitting some questions about SAFE posed by your 
Science and Technology Advisory Panel (STAP). 

2. Attached are answers to the specific questions 
raised by the STAP, presented in a narrative form reflect- 
ing the complexity of some of the issues they addressed. 

These answers represent the coordinated views of OCR and 

ODP, reviewed and endorsed by the DDA and the Director, NFAC. I 

3. At our meeMj^K^w^M^yov^iiow scheduled for 3 April, 

we propose that Mr . rector of the Con- 

solidated SAFE Project Office (CSPO) , present, a brief 
summary which addresses the four concerns you 1 i.st in your 
memorandum, after which we will be prepared to elaborate on ; 
any of those or other STA^oue^^^n^about SAFE. .Wo. will S 

also have available Mr Chief of OCR’s Systems 

Analysis Staff, to discuss NFAC’s extensive efforts to iden- , 
tify user requirements. 

Messrs. : 

wild be at the meeting, and welcome , 

discuss! their questions with them. We would like to suggest, 
however, that it may be profitable for us to spend some 
additional time with them subsequent to our joint meeting 

1 

i\ 
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SUBJECT: Concerns Regarding SAFE 


with you, to supplement the one short briefing previously 
provided for them by SAFE'S managers. 


/s/ Bruce T. Johnson 
Bruce T. Johnson 


CONCUR: 


Clarus VJ. Rico 


Date 

Z 6 MAR 1980 

Director, National Foreign Assessment Center- ~Dote 

Attachments: a/s 
cc: D/CSPO 


Deputy Director for Administration 
STATINTL 


Distribution 

Orig - DC I w/att. 

1 - DDC1 w/att. 

1 - Exec. Reg. w/att. 
1 - D/NFAC w/att. 

1 - DDA w/att. 

.,.1 - d/cspo w/att. 

1 - D/OCR w/att. 

1 - D/ODP w/att. 


Approved For Release 2001/09/03 : CIA-RDP84-00933R0005001 2001 1-4 


Approved For R|^se 2001/09/03 : CIA-RDP84-00933RW5001 2001 1-4 

CONCERN : 

2.0 IIow is SAFE management ensuring that a final working 
system has been developed from the continuing evolution of 
an operationally valid pilot system? How has SAFE taken 
advantage of the experience of similar, very largo systems 
in their: 

1) system architecture, 

2) communication and control, and 

3) changing performance requirements? 

How is .SAFE management ensuring that the system will: 

1) make available data on operation and usage of the 
pilot system to guide development; 

2) be able to modify both system functions and interaction 
capabilities so as to meet changing and evolving 
requirements; and 

3) be able to add now functions and interactions so as 
to meet new requirements. 


RESPONSE: 

a 

i - ' 

: 2.0 The "operationally valid pilot system" from which 

evolution will take place is the system which will be 
I delivered at IOC in December . 1982 . Experience with the 

"Interim" SAFE system inaugurated in 1973 is being used 
in building the operational- system. Data and usage patterns, 
message and query analyses as well as user reactions are 
used in requirements specifications, system sizing, function 
allocation and usage scenario development.. In order to 
ensure adaptability to changing needs and growth, wo have 
dictated the maximum use of general-purpose computers and 
software. 

{ The system architecture proposet^^^th^resul t of an 

18 month design competition between is basec£ TATINTL 

ST/fTINTL on and Government experience with large systems. It 

distributes communications and control functions as well 
| as file processing such that- bottlenecks are avoided and 

,1 parallel expansion is possible without redesign. Hew 

i functions may be added at either the top or mid-level 

\ processors. Functions may be moved between levels to 

) ; compensate for loading or usage changes. 

We expect the initial system to have shortcomings. 

All major systems do. We expect, however, the initial 
\ system to provide significant improvements in service and 

[ i value over the current environment. 
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Responses, to Questions and Comments from Science and Technology 
Advisory Panel Memorandum of 18 March 1980. 


CONCERN : 

1.0 What steps are being taken to ensure that the Agency, 
rather than the contractor is in control of the technical 
aspects of the design of the system? 


RESPONSE: 

1.0 The Agency has in place a strong technical management 
team. The contract effort is under control and the needs 
of two Agencies are being addressed successfully. In 
recognition of the problems of technical communication and 
management control compounded by geographic separat: ion 
a number of steps have been taken as follows: 

a) The Government has contracted for a system development, 
rather trnan technical effort. The contractor is 
responsible for that development with government 
controls. The Government defines the functions 

and performance of the system as seen from a user's 
perspective . The development is performed to 
government requirements specification in accordance; 
with IliL Stds. 490 and 1521 with government appro^p^jINTL 
required of all specifications and designs. The 
Government approves all solicitation documents, 
evaluation plans and contract awards by 

b) Monthly formal project reviews are conducted by the 
Consolidated SAFE Project Office (CSPO) . Technical 
staff interaction daily by phone and virtually 
continuously through travel maintains communication. 

The contractor has several permanent representatives 
located in Rosslyn, headed by a deputy project 
manager for East Coast operations. 

c) Delays in decision making are not geographical 
problems. They are problems associated with hard 
choices . An on-site representative could provide 
oversight and some guidance but those problems of 
larger scope are not one-man problems. A full time 
government representative is being considered for 
transfer to California. Travel will continue to 

be heavy in any event. 
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2.0 - Continued 


The cautionary note in the STAP memorandum is well 
founded. We should expect to take up to a year to introduce 
the system services after which the system will continue 
to evolve. The SAFE budget for 1982 and beyond recognizes 
this process. 
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CONCERN: 

3.0 The SAFE user community consists of Intelligence 
Community analysts covering the full spectrum of research 
into foreign political, military, economic, scientific, 
and technological activity. Their effective use of this 
system and, ultimately, the quality of intelligence they 
produce rest on whether their real needs can be identified 
and satisfied by the system. 

RESPONSE: 

3.0 There has been more user involvement in the definition 
of the SAFE System than in any computer system of which we 
are aware. The interaction is continuing to refine and 
revalidate the system functions with the user. The CSPO 
maintains the balance of interactions with the contractor 
and - through OCR's System Analysis Staff and DIA's user 
points of contact - the users. 

The Consolidated SAFE Requirements Document, which is 
the foundation of the technical development, was developed 
with and largely by the using NFAC and DIA community. 

In the CIA this work began in 1972 and has included: 

o Pilot groups of 50 analysts defining useful 
• functions 

o Pilot systems development in 1973/4 
o Pilot branches to date provide usage data 
o User workshops in 1975 

o 600 analyst survey in 1976 

o SAFE Procedures Development Laboratory 

o Project Upstairs/Downstairs with analysts 

o Newsletters 

o Direct interaction with CSPO and contractor of 
NFAC user representatives 
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3.0 continued 


STATINTL 


1077 ^ f tatus - An extended data collection effort from 
, 7 to Ahe present has developed user requirements which 

have been staffed with top level user management. 

All data gathered on the interim system usage and 
voluminous data . on DIA's DIAOLS system have been forwarded 

*. prior study material has likewise been forwarded 
These data are used to develop system design and cL« Threads ! 

and cont^ol°the r flSS ly ? tS residont in tho CSPO to focus 

ana control the flow of requirements and to ensure that thev 

are met. ihis group coordinates heavily with both Agencies? 

after W SAFE 1 and e th7?%APr C 0 ^ 1 ^ i v tyU system should be developed”' 

nd pot^ti nv u 5 W ° Uld bG a prototype for replication 
ana potentially be a node m a community network. 

Training of users, operators and instructors ie nwt 

and NPAC e ri?rh 10 P,nCn h COntraCt - Both «». OfficS ot TraL?ng 
and NTAC will have instructors trained to support conti nuina 

of e nnhi°p S 3nd ® xpan ? ion of the user community. The Office J 

a f pa?t a orth!s S e??ort U ^ °> eifationa p ™el tia^^s 
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CONCERN: 

4.0 How can the Agency make a reasonable evaluation of the 
current status of SAFE with major portions of the proposed 
operational capabilities either unspecified or uncommunicatcd 
to the Agency? For example, 


1 ) 

2 ) 

3) 

4) 


the user command language and its parsing, 
the user programming language, 
the user editing languages, and 
procedures for backup, including regeneration 
derived files lost in crashes. 


of 


RESPONSE : 

4. All operational capabilities required, including user 
languages and backup capabilities, are specified in the 
Consolidated SAFE Requirements Document written by the 
Government. The contractor's translation of those -.capabilities 


to system design are encompassed in numerous system, sub-s^stera 
and element specifications. These are being developed on " 
schedule with a normal amount of difficulty. Problems are 
addressed early in the process and- corrective action is taken. ' 
For example, the plan for language development was delayed 
due to misunderstandings which required several meetings. 

flj 1 ? ef f ort . x * ? ow on thG road to satisfactory resolution. 
Contract schedule, cost and management are all monitored 
for signs of difficulty. 
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CONCERN : 

5.0 What actions are under way to insure that the Intelligence 
Community has access to CIA SAFE and that CIA SAFE has access 
to DIA SAFE as well as such systems as COINS and SOLIS? 


RESPONSE: 

5.0 The basic system requirement has been given the 
contractor to provide interconnection between the two Agencies. 
Five lines will bo provided with expansion capacity to 25. 

The control of access, differing security clearance practices 
and control of limited access information will have to bo 
worked out among the using and security organisations of the 
Agencies. With the security features of the system being 
developed, it is h ope d that administrative procedures and 
software safeguards will be adequate. 

CIA SAFE consists of: 

o The private files, mail files, route files, and 
the other specific files in SAFE are designed to 
satisfy the needs of individual analysts and have 
limited meaning to other analysts. The tools 
that SAFE provides to manipulate these files 
can, however, be put to use by other Intelligence 
Community Agencies to satisfy the particular 
needs of their analysts. 

o The major Central File (RECON/AEGIS) of the CIA 
portion of SAFE is under consideration for being 
accessible by Intelligence Community analysts. 
Portions of this file are already available on 
COINS. 

o The link between MFAC and DIA will be used initially 
as a tool to coordinate intelligence reporting 
between the two agencies. Eventually, f i le 
s har ing may take place if deemed useful 'by 
individual analysts. 

Generalized community access has not boon envisioned in 
l: he initial system and presents additional security and , 
more vita 1 iy , loading problems. As already noted in I 

response to question 3 we note that a "community" system 
sh ou ld be developed after SAFE and that SAFE would be a 
prototype for replication and potentially be a node in a 
community network. 
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STATSPEG 

CONCERN : 

G.O How will SAFE deal with open source material? 0111^^^^ 
material, either finished publications or field reporting, 
be made available to the analyst through SAFE? How will SAFE 
deal with current newspaper and journal entries? 

' . . ! 

i 

RESPONSE: 

! 

6.0 Newspapers, periodicals, and monographs maybe input 
to SAFE, by production and OCR analysts: the item is indexed ! 

into the computer data bet so and the item is stored either 
locally (drawer, etc.) or in the central microfilm store j 

which is linked to SAFE. Commercial data bases such as | 

MEDLINE, NYTIB, OCLC , NEXIS, SDC, will be accessible through 
an intermediary. Automatic conversion of selected "hard copy" 
open source data to machine-readable form is under development. 

an input with both finished reports and raw 

input supplied to SAFE. Wire services, if subscribed to, STATSPEG 
can be added either on-line or as separate collectors for \ 

periodic input to SAFE; 
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CONCERN: 


7.0 What steps are being taken to ensure that SAFE will be 
designed to allow collaborative usage? 


RESPONSE: 

7. Teleconferencing will be a part of SAFE. This will be 
permitted between CIA and DIA as well as within each Agency. 

The generalized routing function will also be used for 
staffing and coordination as well as for further dissemination 
of information. 

As noted in question 5, there are security and access 
questions yet to be resolved. 
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CONCERN : 


8.0 What steps arc under way to ensure that in the procurement 
of major hardware items, these. items will be compatible with 
existing Agency systems? 


RESPONSE: . 

8. The question of compatibility is complicated by the fact 
that the CIA and DIA have different hardware. CIA/ODP uses 
IBM compatible equipment .while DIA uses mainly 
Compatibility has been factored into the hardware Request for 
™ P ° Sa l val ue has bec n established for cost evaluation. 

1A IBM compatible and vendors thus have a cost advantage 

roughly equivalent ^^an^^pated cost of supporting varied 
architectures. 


Interconnection between SAFE and existing systems in 
each Agency is planned and is part of the contracted effort. 
The interface software for SAFE has been considered as a 
direct contract cost. 
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